Professional & Clinical Issues In Managed Care More On Understanding How HMOs Think, and How To Deal With It. Part B of Lesson 1, Course 2C

Size: px

Start display at page:

Download "Professional & Clinical Issues In Managed Care More On Understanding How HMOs Think, and How To Deal With It. Part B of Lesson 1, Course 2C"

Megan McKinney
6 years ago
Views:

1 Professional & Clinical Issues In Managed Care More On Understanding How HMOs Think, and How To Deal With It. Part B of Lesson 1, Course 2C 1

In the previous section we mentioned the shifts in program design which come along with managed care. And yes, the HMOs are in fact re-designing the delivery system.

2 In the previous section we mentioned the shifts in program design which come along with managed care. And yes, the HMOs are in fact re-designing the delivery system. There are new options for programming, which is good for providers. But along with the new options for treatment, there are new requirements for APPROVAL to deliver that treatment. And new requirements for DOCUMENTATION of the treatment. So let s talk a bit more about those issues. 2

3 Clinical Implications of Managed Care for Providers Part of being successful as a provider under managed care involves understanding what YOUR managed care company means by... the patient has a NEED FOR MEDICALLY NECESSARY TREATMENT. Some are more rigid than others about how they define this need for treatment especially if funds for behavioral health are stretched thin. 3

4 Understanding How HMOs Think. If you do not understand how the MEDICAL NECESSITY criteria are applied to the consumers in your care, getting approval from the HMO to deliver care to your clients will be frustrating and confusing. The issue boils down to, essentially, Well, how sick IS he and how much of what kind of treatment is really NECESSARY, and for how long? When dealing with Behavioral Health (Mental Health, Substance Abuse, Chemical Dependency, or Dual Diagnoses), we are NOT talking about being physically sick as in pneumonia or appendicitis. We are talking about mental and behavioral FUNCTIONALITY, and safety for self and others. These may seem like subjective concepts, to some. 4

5 CEU By Net - Pendragon Associates LLC- c - Jan Revised 2006, April 2015 And Like It or Not, It s Disease Management Not Social Service Managed Care is Medical Model, which revolves around providing a certain Level of Care (LOC) and we must adapt what we write in treatment records (our clients charts), accordingly. In fact, the managed care approach is becoming increasingly medical in orientation. Medical means TREATMENT not simply social service or support. Health plans pay for TREATMENT which targets DYSFUNCTION When DELIVERING AND DOCUMENTING health plan services to individuals with behavioral health diagnoses, we must think 'clinical' and treatment and remediation of DYSFUNCTION which may be a major shift for many professionals. We must crank up the treatment perspective. We must make clinical-sounding statements (not just social service talk) in everything we write. 5

6 So What s the Bottom Line Impact of Level of Care on How We Work? Many of the old ways of providing treatment and of DOCUMENTING the treatment we provide have been discarded or radically modified. Why? A couple of reasons: Funds for health care in general are in very short supply in this country. In order to get a grip on this situation, it made sense that there should be more rigorous management of the LEVEL OF CARE (LOC) that we were providing what KIND, how intensive (how OFTEN), and for HOW LONG? And also, WHO IS SICK ENOUGH to get the more expensive treatments? This issue has had a major impact on who we treat and at what LEVEL OF CARE (LOC)! This is particularly true for Chemical Dependency services and for treatment of persons with less-than-severe Mental Health disorders like depressive episodes and anxiety disorders. 6

7 Poorly Documented Level of Care Deadly! CRITICAL ISSUE: Your client s treatment record MUST support the Level of Care (LOC intensity of services) for which the HMO or other such managed care contractor is paying you! If they are paying for one of the more intensive Levels of Care such as Intensive Outpatient or detox, but your documentation looks like the client DOES NOT MEET THE CRITERIA for that Level of Care (i.e., he does not really need that level of intensity), you may have to REPAY some or all of the money that you have been paid for the period of time that the documentation did not appear to match the level. That s called RECOUPMENT not a good thing for the provider! The Bottom Line with HMOs and other such auditors: Does this chart justify what we are paying them to do the treatment and is this Level of Care (LOC) really needed and is it working? We MUST do Internal Utilization Management to assess this LOC issue, on an ongoing basis. 7

8 CEU By Net - Pendragon Associates LLC- c - Jan 2000-Revised 2006, April 2015 The need to do Internal Utilization Management (IUM). Remember... Just as the HMO, BHO, or MCO must carefully MONITOR the progress of the client through Care Management (or Utilization Management ), the PROVIDER must also closely MONITOR how-often-how-much treatment is needed and provided. Therefore you will need to develop an INTERNAL UTILIZATION MANAGEMENT (IUM) program, to monitor the appropriate Level of Care (LOC) and the UTILIZATION of services. Just like the HMO must do! Providers: Must do Internal Utilization Management (IUM) to monitor the client s NEED for services AND how much service you have provided to him. Have you used up ( utilized ) all of the approved units of service? If so, you will not be paid for additional services UNTIL you obtain a re-auth for more. Note: Failure to perform this IUM task regularly can result in denied claims or recoupment of payments after you have received them! 8

9 Overview of How HMOs Make LOC Treatment Decisions HMOs look at whether the individual is expected to BENEFIT from the treatment (based upon how he has RESPONDED and COOPERATED thus far, and his past HISTORY, and his DIAGNOSIS),... and whether the treatment is considered to be NECESSARY to recovery, based upon how IMPAIRED the individual is, and the PREVAILING STANDARDS of care for his condition,... and whether sufficient PROGRESS is being made to justify the continued expenditure of funds at this level of care. If insufficient progress is being made, then the treatment plan and perhaps the Level Of Care (LOC) will have to change. 9

10 For mental health consumers, HMOs DO NOT look simply at whether or not it would be helpful or nice for the individual to have a certain type of treatment, or whether the patient simply wants it. And they DO NOT base decisions upon a plea that we have always done it this way. Many of the old ways have been discarded or radically modified, in this day of short funds and more rigorous management of treatment. Who gets treatment has changed. For the CD client, HMOs DO NOT look simply at whether or not he or she is having an alcohol or drug related crisis, or whether or not he has experienced a recent relapse, in order to say OK to a treatment request. And they DO NOT base decisions upon a plea that we have always done it this way. In fact, if the client has had multiple relapses to use of alcohol or drugs despite treatment, they may begin to question whether additional treatment beyond detox and basic services is really justified. 10 Again, who gets treatment has changed.

11 The managed care company s decisions may indeed contradict a provider s own CLINICAL BELIEFS about how much of what is needed at any given point in time. For example, the managed care company will probably limit how long an individual remains at the more expensive levels of care. How? The HMO may step them down to a lower level of care (less intensive and less expensive) long before the provider (in the past) would have done so. Is this really bad? Not necessarily. It may just be different, PROVIDED THAT EFFECTIVE ALTERNATIVE PROGRAMS are available through the HMO s coverage. Providers are encouraged to be flexible in providing and using alternative step-down programs for their clients. 11

12 BUT REMEMBER: Is the managed care company telling you that you CANNOT provide the services which you believe the client needs? NO. A provider is always free to deliver any service to a patient according to the provider s own professional judgment or organizational philosophy. HOWEVER if the managed care company does not feel that the services are MEDICALLY NECESSARY and ESSENTIAL for the stabilization of the patient (or if the health plan simply does not cover a certain service or limits how much can be provided), then you WILL NOT BE PAID by the managed care company to provide the service. You will have to do it for free ( pro bono ), or will have to use other funds to cover the cost. 12

This is perhaps the most difficult decision that a provider must make when working within a managed care plan i.e., do you provide a service for FREE, after the HMO says STOP?

13 This is perhaps the most difficult decision that a provider must make when working within a managed care plan i.e., do you provide a service for FREE, after the HMO says STOP? Or do you terminate services because there are no funds to cover the cost? This decision is becoming easier for treatment providers, in this day of shrinking health care funds. Patients are also becoming accustomed to the fact that there may be limits placed on what services are available, or the amount of services that can be provided. Thus, it becomes even more important that there be programs that work faster, and better. Sometimes there are other community programs or funding opportunities available to pick up the slack for individuals who are denied continued treatment, but not always. 13

14 So How Do You Get Approval To Deliver Treatment? By Effectively Communicating Your Client s Condition and Need For a Certain Level of Care. If you have difficulty communicating with the HMO s Care Manager about the nature and severity of your client s condition in writing and verbally you will have trouble obtaining authorization for services. This is especially true under CAPITATED managed care (where the HMO is at risk of losing money on the contract, and money is tighter). You must be clear, clear, clear when you talk to the managed care company about what is needed. 14

15 Documenting Your Client s Condition And What You Did To Help Him. AND if you DO get authorization to deliver the services, will you have trouble DOCUMENTING WHY you did what you did?... or HOW you delivered the treatment?... or how the patient RESPONDED to the treatment? Maybe? If you don t make these things clear to the HMO, you will be at risk of having to pay back money (called recoupment ). Why? The managed care company may RETROSPECTIVELY audit your clinical records (after they have paid you), to determine if the money they paid you to deliver the treatment was well spent and that the treatment met the criteria for the service. 15

16 Documentation Style It s Crucial to Managed Care Success Managed Care programs are not your same old Block Grant or State Revenue Program. The HMO or other such managed care company is typically dispensing funds a dollar at a time... for specific types of TREATMENT interventions, for specific types and severities of PROBLEMS, at specific LEVELS OF CARE( LOC). Your documentation of why you requested the LOC, and the treatment you then provided, must clearly support this level of specificity. 16

17 CEU By Net - Pendragon Associates LLCc - Jan Revised 2006, April 2015 You must think about your client s treatment in the same way that the HMO s Care Manager is thinking when he or she reviews the case: WHY should the HMO spend money on this case and for THIS treatment? You must put away soft-pedal language and euphemistic ways of talking about the client s problems. You must be willing to address DYSFUNCTION and PROBLEMS as well as strengths, because they do not pay for strengths they pay for STABILIZATION of DYSFUNCTION, PROBLEMS and SYMPTOMS! Q: So HOW, exactly, do the HMOs determine if a particular treatment is MEDICALLY NECESSARY? And is the DIAGNOSIS enough to determine this? A: Take a look at the next few slides the CORE CONCEPTS. 17

Four Core Concepts They Shape the HMO s Decisions, and They Shape How We Request and Document Treatment There are four core concepts which are dear to the heart of the HMO and which determine whether

18 Four Core Concepts They Shape the HMO s Decisions, and They Shape How We Request and Document Treatment There are four core concepts which are dear to the heart of the HMO and which determine whether they approve a treatment request or not. Obviously, these concepts should shape our approach to documentation within the client s treatment record (chart). If we will adhere to these concepts when we write in a chart, we will ensure that we and the HMO are on the same page. This is crucial, when the HMO s auditors come to pay us (AND our treatment records) a visit! 18

19 The Four Core Concepts What are they? The Health Insurance plans will either AUTHORIZE or DENY treatment for a client, based upon the CORE CONCEPTS see to your right. The core concepts look at whether the treatment you want to provide is MEDICALLY NECESSARY. EVERYTHING that we write in a client s treatment record (chart) should therefore be guided by these core concepts. Why? Because what we write in the record will SUPPORT the AUTHORIZATION that we obtain, and will demonstrate that we did in fact DO THE TREATMENT which was authorized. 1. Medical Necessity Is the Treatment Needed to Improve, Maintain, or Prevent Deterioration? 2. Current Functionality Diagnosis is Not Enough! 3. Treatment Goals & Interventions Do They Match the Diagnosis and Functionality That Is Described in the Assessment and Elsewhere? 4. Progress Is the Client Responding to Treatment, and Likely to Benefit with More? 19

20 1. Medical Necessity THE HMO S CORE CONCEPTS 1. It must be CLEAR that the treatment which is approved is MEDICALLY NECESSARY. Medical necessity is defined differently in every state. But these are some of the criteria that are quite common, in determining MEDICAL NECESSITY. The proposed treatments... are REASONABLE AND NECESSARY in order to diagnosis or treat a specific mental health or chemical dependency disorder; are needed to IMPROVE OR TO MAINTAIN or to prevent deterioration of functioning resulting from the disorder; are in accord with PROFESSIONALLY ACCEPTED clinical guidelines and standards of practice for behavioral health care; and 20

21 CEU By Net - Pendragon Associates LLC- c - Jan 2000-Revised 2006, April 2015 are the most appropriate level or supply of service which can SAFELY be provided; and are furnished in the most appropriate and LEAST RESTRICTIVE setting in which services can be safely provided; and could not be omitted without ADVERSELY AFFECTING the Member s mental and/or physical health or the quality of care rendered, AND there is a REASONABLE EXPECTATION that the treatment will result in PROGRESS. 21

22 CEU By Net - Pendragon Associates LLC- c - Jan Revised 2006, April Functionality It s Primary The diagnosis is important BUT diagnosis alone will not justify a particular treatment. WHY? It is the patient s FUNCTIONALITY that is the most important, when deciding if a particular treatment is needed, and for how long. For example, an individual may have a diagnosis of Bipolar Disorder (and may have been hospitalized many times in the past)... but is now stabilized on medication, is back to work, is relating well to family and friends and co-workers, and is otherwise no longer a danger to himself or others. Does this individual continue to need intensive services? NO. On the other hand, e.g., if an individual is struggling with maintaining a job, is having acute symptoms of a disorder, is perhaps at risk of inpatient admission, and/or is having major difficulty with everyday functionality, then intensive treatment may well be considered MEDICALLY NECESSARY. 22

23 3. Treatment Goals and Interventions Must Match the Functional Deficits & the Diagnosis When treatment is authorized, it is not a free pass to do whatever the provider wants to do. The managed care company is authorizing a SPECIFIC SERVICE. And that is the only service for which we can submit a CLAIM FOR PAYMENT. As to the DETAILS of how we provide the service, everything we do must address the major FUNCTIONAL ISSUES that we identified in the assessment, and for which we obtained the authorization to provide treatment. And we CANNOT IGNORE A DIAGNOSIS! For example, if a consumer is depressed AND is also using or abusing DRUGS or alcohol, we MUST ADDRESS the substance abuse or dependency in the treatment plan and in the services we provide. 23

24 4. Progress It s Essential If We Are to Continue Treatment Managed Care cannot pour limited resources down the drain! Therefore, the HMO looks for PROGRESS being made, when we approach them to authorize more care. If a consumer is NOT RESPONDING to an approved service i.e., if he is NOT MAKING PROGRESS, then we must take a close DOCUMENTED look at what needs to be changed, AND THEN make significant CHANGES IN THE ITP what we are doing with the consumer, and perhaps even REQUEST CHANGES IN THE AUTHORIZED SERVICE. 24

NOTE: If the individual FAILS TO BENEFIT from the treatment that is available to him, and has not benefited from revised plans of care, then the HMO may ultimately make a decision to move to a

25 NOTE: If the individual FAILS TO BENEFIT from the treatment that is available to him, and has not benefited from revised plans of care, then the HMO may ultimately make a decision to move to a maintenance regimen that seeks to keep the individual basically stable and out of danger. Goals to move the individual forward with significant progress may be abandoned, if it is clear that he has reached a plateau. A PLATEAU means that it is unlikely that he is going to make additional progress regardless of what interventions are applied. 25

26 Q: Do these 4 HMO concepts ALWAYS shape what we write in a treatment record? A: YES, if you want to be paid for what you do. When an HMO or other such managed care company has paid the provider for providing a billed service to an enrollee, they ASSUME that we have adhered to ALL of these Core Concepts seen on previous pages. But the only way that they can know for sure that we have been faithful to these concepts is to READ THE RECORDS. It s called an AUDIT. If the HMO finds our records to be lacking, they can take back all or a portion of what they have paid us. Certainly, this is to be avoided! 26

27 Why Are HMOs So Picky? WHY are the HMOs so picky? Remember that in public sector healthcare programs such as Medicaid, funds are generally short all the way around much more so than in commercial private insurance plans. The funds available to the managed care company are quite LIMITED, while the needs of the enrollees is GREAT. Obviously, the use of the limited funds by YOU, the provider, must be carefully MONITORED. 27

28 They are going to take a CLOSE look at what you did with their money. This means that the managed care company will be taking a VERY close look at whether providers have ACCURATELY reflected the seriousness of the consumer s condition when requesting services, and then, was treatment delivered EFFECTIVELY. And does what you billed them for correspond with what is DOCUMENTED in the consumer s record? If not, there will be problems! 28

CEU By Net - Pendragon Associates LLC- c - Jan 2000-Revised 2006, April 2015 Want the nitty-gritty details of how to audit your own records as the HMO will audit them? AUDITABLE RECORDS.

29 CEU By Net - Pendragon Associates LLC- c - Jan 2000-Revised 2006, April 2015 Want the nitty-gritty details of how to audit your own records as the HMO will audit them? AUDITABLE RECORDS. Lessons 2 and 3 of Course 2B provide those details. You may wish to enroll in that course, with the goal of knowing exactly HOW the HMO looks at records to determine compliance with Level of Care criteria and other such factors. Understanding these issues well in advance of an on-site or desk audit by the HMO is important in order to protect your practice or program from recoupment of claims payments that you have already received from the HMO. It s the key to success. Check out our Course 2B. What Can Go Wrong In That Chart! a.k.a. They re Coming TO Audit WHEN? 29

30 CD Issues Related to Care Management Decisions, Which Need Repeating Special Note... to be remembered as we work through this and all courses offered for Managed Care: Standardized Level of Care protocols (such as those typically used by the HMOs, BHO, MCOs) are believed by many to result in questionable clinical outcomes for chemically dependent consumers. Reason: These protocols may not adequately accommodate the CD population s inherent tendency to relapse repeatedly while they are on the road to recovery. What to do here? Encourage your state and HMO to engage in good Quality Management studies of outcomes for CD patients! And for your most relapse-prone clients especially those who recycling in and out of detox frequently ask for a Case Rate, where you can make treatment decisions more freely where you hold the cards. 30

31 Bottom line, how does the HMO control its RISK i.e., how does it keep from losing money on the contract? In a few words, they typically contract with providers to bring in some NEW PROGRAMS and treatment options (i.e., alternatives to traditional treatment such as diversionary and step-down programs) which may not have been available or accessible before... so that CARE MANAGEMENT can work. Care Management seeks to ensure the right services, in the right amount, at the right level of intensity, for the right amount of time. AND they MOVE THE MONEY AROUND! Always wanted to operate an Intensive Outpatient Program (IOP)? Now you have a reason, and there may be new HMO-related funding to 31 do it with!

More on how the HMO s RISK CONTROL Measures Affect Providers... And it s NOT all bad! Example: As we have said, to minimize their risk, HMOs can move the money around.

32 More on how the HMO s RISK CONTROL Measures Affect Providers... And it s NOT all bad! Example: As we have said, to minimize their risk, HMOs can move the money around. Let s say that there are TOO MANY inpatient or detox days being used, and there are not enough Intensive Outpatient (IOP) slots which could reduce the need for inpatient or detox. This clearly requires a fix. So, the HMO will want to EXPAND the IOP slots within the network. OR, if consumers with serious mental illness are deteriorating after an inpatient stay, the managed care company will want to contract with providers who can deliver INTENSIVE community based programs designed to keep people out of the hospital such as Assertive Community Treatment (ACT) Teams and intensive home-based treatment programs. 32

33 ... risk affects providers... Are you new to the provider scene? This may be your chance! In order to control their RISK, HMOs expand the network of providers beyond those who have traditionally provided the services for the target population. They ADD new providers who have demonstrated that they are competent, creative, and are willing to CLOSE THE GAPS that may be present in the delivery system. 33

34 ... risk affects providers... Looking for quality! Do you take notice of whether or not the treatment you are providing is actually EFFECTIVE? HMOs ensure that money is spent only on services known to be effective, so that there is more bang for the buck in terms of good outcomes and the use of their limited funds. Working this way reduces their RISK. Consequently, community programs which have demonstrated that they have good program OUTCOMES are important to HMOs. 34

if you express an interest in working with the HMO to measure and track the

35 ... risk affects providers... If you or your organization have worked hard to ensure good outcomes, and if you express an interest in working with the HMO to measure and track the treatment outcomes of consumers in your care, the at risk entity (the HMO or other such contractor) will sit up and take notice. 35

36 Are you the FLEXIBLE type willing to look at NEW ways of delivering and documenting treatment? This is important because HMOs make decisions [called Care Management; or Utilization Management ] about how much treatment is required of a certain type before moving the individual on to another treatment modality. These decisions may contradict how treatment has always been provided. This part of managed care is oftentimes painful. But there are alternative treatment scenarios that may work just as well for many individuals. 36

37 Yes, the HMO s decisions may contradict a provider s prevailing clinical beliefs about how much of what is needed at any given point in time. For example, the managed care company will probably limit how long an individual remains at the more expensive levels of care they may step them down to a lower (less intensive and less expensive) level of care long before the provider (in the past) would have done so. And program providers may even begin to disagree among themselves as to how much of what is needed. 37

38 Aren t there any controls on these limitations? Yes, there are controls. It is up to the State or contracting authority to control misuse of the treatment limitation process, so that clearly inappropriate limitation of services does not occur. But being FLEXIBLE in looking at nontraditional ways to deliver treatment is VERY IMPORTANT if you are a provider. And if these provider flexibility characteristics seem to describe you or your agency, then you may be a candidate to TAKE ON SOME LIMITED RISK! 38

39 Limited Risk Sharing With Providers It CAN be The Good! HMOs may want to share the risk with certain providers called Limited Risk Sharing or Shared Risk. This is often a good option when it is available! Most of these approaches are very workable, and these options... depart from sure thing block grants and fixed State contracts, but do it constructively, and encourage creativity, efficiency, and ownership of the managed care rollout by providers. They learn to managed the care of their consumers, too! The Good? Oftentimes, YES. 39

40 One Limited Risk example for providers. A CASE RATE is a limited risk or shared risk payment arrangement which may be available to providers depending upon the source of funds in the managed care plan. In this fee arrangement, the provider agrees to accept a flat rate fee for each preapproved enrollee, intended to cover an array or specified package of services which the client may require during a set period of time [such a month or six months]. 40

Case Rates In this contract option, the provider is given more control over the individual plan of care and the determination of which services will be provided to individual clients, and for how

41 Case Rates In this contract option, the provider is given more control over the individual plan of care and the determination of which services will be provided to individual clients, and for how long. With a case rate, you do not have to ask the HMO for permission at each step of the client s treatment process, once the arrangement has been approved for a period of time usually from 1 to 3 months. Caveat: Case Rates are typically reserved for use with HIGHLY RECIDIVISTIC consumers of very expensive services such as inpatient and detox. A case rate will hopefully stop the drain on the plan s cash flow. 41

42 Case Rate... This sort of agreement is indeed risk, but without hanging over the edge. Under a Case Rate arrangement just like an HMO the provider is risking or wagering that the outpatient treatment and support services which he must provide to the majority of the case-rated clients will be LESS extensive/intensive rather than MORE extensive/intensive. The assumption is that most case rate clients will NOT require extensive services. If that is so, then the total pot of Case Rate dollars will to cover the intensive services required by a minority of the clients. And hopefully there will be some money left over! 42

43 Case Rate... To make a Case Rate work, the provider must ensure that crisis intervention and support services are available for ALL of the CASE RATE clients, so that MOST of these clients will NOT require a lot of high-end intensive services [or, will not relapse following the delivery of high-end services]. What s high end? These are the most costly outpatient services such as Intensive Outpatient (IOP) and Day Treatment. What is the CD or MH provider doing here? He is carefully managing the care received by his Case Rate clients, so that his money will stretch - just like a mini-bho. 43

44 Case Rate... It s GREAT for kids! Case Rates have worked well with Seriously Emotionally Disturbed children and adolescents, and with children in CPS custody, in some locations, and work well for monitoring and behavioral health mentoring of juvenile justice probationers in various programs across the country. 44

45 Want to know MORE about the design of HMO contracts? Which are The Good and which are The Bad? And more LIMITED RISK options for providers? And how to negotiate a special contract with a managed care company, even AFTER the plan has gone live? And contract issues to beware of including claims denials? Then check out Course 1C Understanding Capitation-Type Contracts and Cost Containment: How It s Done (aka The Good, The Bad And The Ugly of Managed Care ). 45

46 Congratulations! You have completed Part B of Lesson 1 of Course 2C. You may complete the short quiz for this lesson, either now or later, by simply closing this page, and clicking on Quiz 2, Course 2C. You can take each quiz as many times as you want, until you pass it. There is no penalty for failing a test and you may retake it immediately. To move on to the next and final lesson of Course 2C, either close this page now and click on Lesson 2, Course 2C, or return later to the site, sign in, and click where you want to go! 46

Course 3A. Lesson Three. Contracting and Risk Sharing With Providers!

Course 3A. Lesson Three. Contracting and Risk Sharing With Providers! Course 3A Lesson Three Contracting and Risk Sharing With Providers! This Document is Copyright Protected - - CEU By Net - January 2000 Revised 2009, 2011, April 2015 1 Risk Issues Affect Providers, Too!